> For the complete documentation index, see [llms.txt](https://jotter.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jotter.gitbook.io/red-team/active-directory/post-exploitation/pivoting-to-entra.md). # Pivoting to Entra The success you have pivoting from on-premises infrastructure to Entra ID will depend largely on the credential material available to you as well as the tenant's conditional access policies. You should conduct all attempts, if possible: * From an Entra-joined and Intune-compliant device. * From within an IP-whitelisted network (such as office VPN). If you have a foothold in Entra, it is worthwhile to **identify devices owned by highly privileged users** for further attacks, such as PRT dumping or cookie theft. ### Azure AD Connect Servers Azure AD connect servers are the link between on-premises AD accounts and the Entra ID tenant. While these were historically strong targets, changes to the permissions of the Entra ID role for `Directory Synchronize Accounts` has limited the post-exploitation opportunities. What's more, authentication for this account has since moved to host-bound certificates, although this only affects up-to-date tenants and Connect servers. ### Primary Refresh Tokens A strong option is to locate an Entra-joined device and dump the stored PRT. PRTs are tokens minted with an MFA claim baked in - they are "immune" to CAPs specifying MFA prompts. ``` ipmo "AADInternals-Endpoints" # Get the PRToken $prtToken = Get-AADIntUserPRTToken # Get an access token for AAD Graph API and save to cache Get-AADIntAccessTokenForAADGraph -PRTToken $prtToken ``` ### ESTSAUTH Cookie Theft Entra permits two cookies, `ESTSAUTH` and `ESTSAUTHPERSISTENT` to enable persistent authentication in exchange for tokens. You can extract these from compromised workstations via DPAPI, although Chrome's app-bound encryption will prevent effective harvesting if it's the primary browser. After collection, inject them into a browser to receive an authenticated session. {% code expandable="true" %} ``` # Collect donpapi collect -u Administrator -p asdf --fetch-pvk -t 10.0.0.225 --domain contoso.com -c Chromium,Firefox --dc-ip 10.0.0.4 -nr # Inject via manual cookie extension or Playwright ``` {% endcode %} ### Account Mismatch/Confusion In hybrid environments, you may be able to mismatch the connection between an Entra and Active Directory identity - substituting a Global Administrator's password for an AD account you own. This is relatively complex and involves deleting the locally linked GA's AD account, so it's not always a great idea. ### Cracking/Changing Passwords and Praying If you've cracked any passwords from NTDS, or want to force change them and wait for a sync cycle, you can spray your collected creds and pray for CAP gaps. ``` entra_jumper.py -t contoso.com -f userpass.txt changepasswd.py from impacket ``` ### Azure Tokens Depending on the installed version of the Azure AD PowerShell module, Azure access tokens may be encrypted with DPAPI or stored simply in cleartext. Inspect the `C:\Users\user1\.Azure` folder for these files: ``` # Cleartext accessToken.json tokenCache.dat AzureRmContext.json azureProfile.json # Encrypted with DPAPI msal_token_cache.bin ``` ### Seamless SSO If an Entra tenant is configured for seamless SSO, Kerberos tickets issued by on-prem KDC may essentially be used to request access tokens on behalf of any principals. As such, this is an extremely useful (and stealthy) attack vector when you have access to on-prem KDCs. [SeamlessPass](https://github.com/Malcrove/SeamlessPass?ref=news.risky.biz) is a good tool for this attack. ``` seamlesspass -tenant corp.com -domain corp.local -dc dc.corp.local -tgt seamlesspass -tenant corp.com -domain corp.local -dc dc.corp.local -username user -ntlm DEADBEEFDEADBEEFDEADBEEFDEADBEEF ```